Skip to main content
RDOutlook
RDOutlook
New Member
February 3, 2016
Solved

SSL.RSA.Temporary.Key.Security.Bypass

  • February 3, 2016
  • 1 reply
  • 6506 views

All,

 

Can anybody here assist me with outbound traffic events. (from a small number of our internal hosts to the internet)

 

Event: SSL.RSA.Temporary.Key.Security.Bypass

Additional information: http://www.fortinet.com/ids/VID40207

 

Since a few months a fairly small number of machines generate an awful lot outbound events to specific IP addresses.

We are pretty confident this is not something to be worried about as we have leveraged additional tools to investigate our internal hosts. Still very interested what this can be related to.

 

As a reference point, in the month of January 3 hosts generated 40825 events.

 

Following IP addresses are noted for these 3 hosts as the Destination address they are communicating with. (AT&T addresses belonging to CerfNet)

 

12.130.55.203: 14928 events

12.130.55.186: 5279 events

12.130.55.56: 10519 events

12.130.55.172: 3346 events

12.130.55.187: 3386 events

206.19.56.155: 3347 events

 

Anybody any idea?

 

R

    Best answer by Patrickh99

    I get the alert from a program called ATT Connect.  It is a Webex type program that AT&T uses for their teleconferences that auto-starts and runs in the background on PCs. It does some communication in the background every few minutes to generate the alerts.

     

    I have not figured out how to get rid of the alert other than shutting off the program.

    1 reply

    AndrewG
    AndrewG
    New Member
    February 4, 2016

    Same thing here but with IP 12.130.142.57. Nothing w/ virus total. i'm considering scanning for vuls using metaspolit.

    Only happening on one single machine, many times a hour.

    1 09:46:13 FGT90D3Z140xxxxx deny 192.168.x.x 12.130.142.57 SSL_SSLv2 HTTPS block APP1IPS1 SSL.RSA.Temporary.Key.Security.Bypass

    Patrickh99
    Patrickh99Answer
    New Member
    February 8, 2016

    I get the alert from a program called ATT Connect.  It is a Webex type program that AT&T uses for their teleconferences that auto-starts and runs in the background on PCs. It does some communication in the background every few minutes to generate the alerts.

     

    I have not figured out how to get rid of the alert other than shutting off the program.

    RDOutlook
    RDOutlookAuthor
    New Member
    February 16, 2016

    Thanks!

     

    I am in process of confirming this information and it looks to be indeed the root cause for this traffic.

    Interesting on our side is that we use AT&T's managed service for IDS/IPS.

     

    I will open a case with them to investigate their own software.

     

     

    Terms & ConditionsAccessibility statement